Should the same be done with $wgVariantArticlePath, if it is not false?
It looks less likely to be an attack vector, and admins are less likely to set it to just '$1' as the '$2' is sort of necessary for it to be useful.